CVE-2026-112153
HighCVSS 7.3Summary
A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file Officers/addOfficer.php of the component Officer Registration Form; manipulation of the argument offName/offID/ID/contact/gender/weapon/role results in SQL injection. The attack can be initiated remotely, and the exploit is now public and may be used.
Risk Assessment
Remote SQL injection is possible, potentially leading to data leakage or modification in the database. The project has not responded to the report, so the risk remains unmitigated.
Recommendation
Implement validation and parameterization of SQL queries in Officers/addOfficer.php. Monitor the project for updates and consider additional protections such as a WAF.
Other vulnerabilities in Criminal-Management-System
See all- CVE-2026-112152High
A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqli_query of the file Officers/searchOff.php of the component Search Page; manipulation of the argument Search leads to SQL injection. The attack may be performed from remote, and the exploit has been disclosed publicly and may be used.
- CVE-2026-112151High
A SQL injection vulnerability was found in vraj404 Criminal Management System in home.php within the Submission Form. Manipulation of the id/name/offName/crime/dob/arrDate/crimeDate/sex/address/folder/more arguments allows SQL injection. The attack can be performed remotely and a public exploit is available.
- CVE-2026-112150High
A SQL injection vulnerability exists in search.php of vraj404 Criminal-Management-System via manipulation of the Search argument. The attack can be executed remotely and a public exploit has been released.
- CVE-2026-112149High
An unrestricted file upload vulnerability exists in the move_uploaded_file function in home.php of vraj404 Criminal-Management-System via manipulation of the my_img argument. Remote exploitation is possible and a public exploit is available.
Original NVD description (English source)
A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument offName/offID/ID/contact/gender/weapon/role results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS